CVE-2026-3696 is an OS command injection flaw in the Totolink N300RH router, scored 7.3 (High) in the CVE record. It sits in the WPS setup function of the web management CGI and can be started remotely. The record lists no fix, so limit access to the router and check the vendor site.
What's affected
- Product: Totolink N300RH (version 4 hardware in the researcher report)
- Affected firmware: 6..1c.1353_B20190305 in the record. The researcher report names V6.1c.1353_B20190305
- Affected component: the CGI handler at
/cgi-bin/cstecgi.cgi, functionsetWiFiWpsConfig - Fixed version: none listed in the record
The record says an exploit has been made public. It does not say the flaw is being used in attacks, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog. The researcher's issue says earlier versions with the same code are likely affected, but that was not tested, so treat it as a guess.
How to check if you're exposed
Check the model and firmware shown on the router's status or firmware page. If it is an N300RH on firmware from 2019 or similar, assume you are affected unless the vendor says otherwise.
Next, check whether the web management interface can be reached from outside your network. From a device outside your network, test the router's public address on the web ports. Remote management should be off unless you truly need it. The record says the attack can be started remotely, which is why exposure of the management page is the main question.
What to do now
- Turn off remote management on the router so the web interface is reachable only from the inside network.
- Check the Totolink site for a newer firmware for the N300RH and install it if one exists.
- Put the router behind another firewall, or restrict who can reach the management page by address.
- Change the administrator password and review the router configuration, such as DNS settings and port forwards, for changes you did not make.
- If no fix appears, plan to replace the router. Older consumer routers often stop getting updates.
Why it matters
Command injection means input from a request reaches a shell command without safe handling. The record files this under CWE-77 and CWE-78. The researcher's report says the CGI code builds a shell command string from a user supplied parameter and runs it. On a router, that command runs with the device's own rights, which is often the highest level.
Consumer routers sit between you and everything else. A compromised one can see and redirect traffic. Because patches for small router lines are slow or missing, reducing exposure of the management page is the control that works today.
Quick check
Is there a firmware fix?
The record lists none. Check the Totolink site for a newer release and keep the management page off the internet in the meantime.
Is it being exploited?
The record says an exploit is public. It does not say attacks are happening, and the CVE is not in the CISA catalog.
Sources
Last reviewed: 19 October 2026.
